HSTS missing header vulnerability detection by DDJavierSantos · Pull Request #5520 · DataDog/dd-trace-java

DDJavierSantos · 2023-07-04T08:24:28Z

What Does This Do

Detect and report HSTS header missing vulnerabilities

Motivation

To cover all of the header vulnerabilities

Additional Notes

smola

One small change, then good to go.

smola

Applied the change myself.

pr-commenter · 2023-08-09T17:09:39Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
commit	1.20.0-SNAPSHOT~42a3ef6e44	1.19.0-SNAPSHOT~da0fe7a8f0
config	baseline	candidate

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
module	Agent	Agent
parent	None	None
variant	appsec	appsec

Summary

Found 0 performance improvements and 1 performance regressions! Performance is the same for 61 cases.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:petclinic:iast:IAST	worse [+483.139µs; +845.222µs] or [+3.625%; +6.342%]	13.992ms	13.328ms

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.19.0-SNAPSHOT~da0fe7a8f0, baseline=1.20.0-SNAPSHOT~42a3ef6e44

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (993.959 ms) : 0, 993959
Total [baseline] (9.229 s) : 0, 9228959
Agent [candidate] (984.74 ms) : 0, 984740
Total [candidate] (9.221 s) : 0, 9221445
section appsec
Agent [baseline] (1.078 s) : 0, 1077673
Total [baseline] (9.352 s) : 0, 9351863
Agent [candidate] (1.069 s) : 0, 1068597
Total [candidate] (9.214 s) : 0, 9214227
section iast
Agent [baseline] (1.087 s) : 0, 1087050
Total [baseline] (9.447 s) : 0, 9447180
Agent [candidate] (1.086 s) : 0, 1086472
Total [candidate] (9.397 s) : 0, 9397035
section profiling
Agent [baseline] (1.157 s) : 0, 1156742
Total [baseline] (9.484 s) : 0, 9483903
Agent [candidate] (1.161 s) : 0, 1161199
Total [candidate] (9.487 s) : 0, 9487326

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	993.959 ms	-
Agent	appsec	1.078 s	83.714 ms (8.4%)
Agent	iast	1.087 s	93.091 ms (9.4%)
Agent	profiling	1.157 s	162.783 ms (16.4%)
Total	tracing	9.229 s	-
Total	appsec	9.352 s	122.905 ms (1.3%)
Total	iast	9.447 s	218.222 ms (2.4%)
Total	profiling	9.484 s	254.945 ms (2.8%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	984.74 ms	-
Agent	appsec	1.069 s	83.857 ms (8.5%)
Agent	iast	1.086 s	101.733 ms (10.3%)
Agent	profiling	1.161 s	176.459 ms (17.9%)
Total	tracing	9.221 s	-
Total	appsec	9.214 s	-7.218 ms (-0.1%)
Total	iast	9.397 s	175.591 ms (1.9%)
Total	profiling	9.487 s	265.881 ms (2.9%)

gantt
    title petclinic - break down per module: candidate=1.19.0-SNAPSHOT~da0fe7a8f0, baseline=1.20.0-SNAPSHOT~42a3ef6e44

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (615.674 ms) : 0, 615674
BytebuddyAgent [candidate] (609.864 ms) : 0, 609864
GlobalTracer [baseline] (286.804 ms) : 0, 286804
GlobalTracer [candidate] (284.408 ms) : 0, 284408
AppSec [baseline] (50.717 ms) : 0, 50717
AppSec [candidate] (50.321 ms) : 0, 50321
Remote Config [baseline] (672.603 µs) : 0, 673
Remote Config [candidate] (669.443 µs) : 0, 669
Telemetry [baseline] (5.514 ms) : 0, 5514
Telemetry [candidate] (5.333 ms) : 0, 5333
section appsec
BytebuddyAgent [baseline] (615.39 ms) : 0, 615390
BytebuddyAgent [candidate] (610.024 ms) : 0, 610024
GlobalTracer [baseline] (286.685 ms) : 0, 286685
GlobalTracer [candidate] (283.393 ms) : 0, 283393
AppSec [baseline] (135.11 ms) : 0, 135110
AppSec [candidate] (135.177 ms) : 0, 135177
Remote Config [baseline] (738.426 µs) : 0, 738
Remote Config [candidate] (727.591 µs) : 0, 728
Telemetry [baseline] (5.203 ms) : 0, 5203
Telemetry [candidate] (5.142 ms) : 0, 5142
section iast
BytebuddyAgent [baseline] (714.367 ms) : 0, 714367
BytebuddyAgent [candidate] (713.065 ms) : 0, 713065
GlobalTracer [baseline] (271.453 ms) : 0, 271453
GlobalTracer [candidate] (271.557 ms) : 0, 271557
AppSec [baseline] (47.339 ms) : 0, 47339
AppSec [candidate] (47.257 ms) : 0, 47257
IAST [baseline] (13.328 ms) : 0, 13328
IAST [candidate] (13.992 ms) : 0, 13992
Remote Config [baseline] (647.536 µs) : 0, 648
Remote Config [candidate] (664.578 µs) : 0, 665
Telemetry [baseline] (5.613 ms) : 0, 5613
Telemetry [candidate] (5.561 ms) : 0, 5561
section profiling
BytebuddyAgent [baseline] (623.35 ms) : 0, 623350
BytebuddyAgent [candidate] (624.125 ms) : 0, 624125
GlobalTracer [baseline] (349.764 ms) : 0, 349764
GlobalTracer [candidate] (351.642 ms) : 0, 351642
AppSec [baseline] (49.302 ms) : 0, 49302
AppSec [candidate] (49.654 ms) : 0, 49654
Remote Config [baseline] (661.35 µs) : 0, 661
Remote Config [candidate] (658.38 µs) : 0, 658
Telemetry [baseline] (5.384 ms) : 0, 5384
Telemetry [candidate] (5.396 ms) : 0, 5396
ProfilingAgent [baseline] (75.495 ms) : 0, 75495
ProfilingAgent [candidate] (76.972 ms) : 0, 76972
Profiling [baseline] (75.519 ms) : 0, 75519
Profiling [candidate] (76.996 ms) : 0, 76996

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.19.0-SNAPSHOT~da0fe7a8f0, baseline=1.20.0-SNAPSHOT~42a3ef6e44

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.0 s) : 0, 1000327
Total [baseline] (8.701 s) : 0, 8700798
Agent [candidate] (982.686 ms) : 0, 982686
Total [candidate] (8.618 s) : 0, 8618487
section appsec
Agent [baseline] (1.07 s) : 0, 1070328
Total [baseline] (8.721 s) : 0, 8720841
Agent [candidate] (1.079 s) : 0, 1078503
Total [candidate] (8.721 s) : 0, 8720618
section iast
Agent [baseline] (1.092 s) : 0, 1092422
Total [baseline] (9.194 s) : 0, 9194411
Agent [candidate] (1.086 s) : 0, 1086103
Total [candidate] (9.197 s) : 0, 9197119
section profiling
Agent [baseline] (1.155 s) : 0, 1155145
Total [baseline] (8.887 s) : 0, 8886692
Agent [candidate] (1.175 s) : 0, 1174900
Total [candidate] (9.012 s) : 0, 9012180

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.0 s	-
Agent	appsec	1.07 s	70.001 ms (7.0%)
Agent	iast	1.092 s	92.095 ms (9.2%)
Agent	profiling	1.155 s	154.819 ms (15.5%)
Total	tracing	8.701 s	-
Total	appsec	8.721 s	20.042 ms (0.2%)
Total	iast	9.194 s	493.612 ms (5.7%)
Total	profiling	8.887 s	185.893 ms (2.1%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	982.686 ms	-
Agent	appsec	1.079 s	95.817 ms (9.8%)
Agent	iast	1.086 s	103.417 ms (10.5%)
Agent	profiling	1.175 s	192.215 ms (19.6%)
Total	tracing	8.618 s	-
Total	appsec	8.721 s	102.13 ms (1.2%)
Total	iast	9.197 s	578.632 ms (6.7%)
Total	profiling	9.012 s	393.692 ms (4.6%)

gantt
    title insecure-bank - break down per module: candidate=1.19.0-SNAPSHOT~da0fe7a8f0, baseline=1.20.0-SNAPSHOT~42a3ef6e44

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (620.395 ms) : 0, 620395
BytebuddyAgent [candidate] (608.445 ms) : 0, 608445
GlobalTracer [baseline] (288.754 ms) : 0, 288754
GlobalTracer [candidate] (284.083 ms) : 0, 284083
AppSec [baseline] (50.128 ms) : 0, 50128
AppSec [candidate] (50.023 ms) : 0, 50023
Remote Config [baseline] (677.245 µs) : 0, 677
Remote Config [candidate] (659.262 µs) : 0, 659
Telemetry [baseline] (5.5 ms) : 0, 5500
Telemetry [candidate] (5.364 ms) : 0, 5364
section appsec
BytebuddyAgent [baseline] (610.431 ms) : 0, 610431
BytebuddyAgent [candidate] (615.225 ms) : 0, 615225
GlobalTracer [baseline] (283.901 ms) : 0, 283901
GlobalTracer [candidate] (287.125 ms) : 0, 287125
AppSec [baseline] (135.798 ms) : 0, 135798
AppSec [candidate] (135.656 ms) : 0, 135656
Remote Config [baseline] (734.895 µs) : 0, 735
Remote Config [candidate] (734.162 µs) : 0, 734
Telemetry [baseline] (5.162 ms) : 0, 5162
Telemetry [candidate] (5.189 ms) : 0, 5189
section iast
BytebuddyAgent [baseline] (718.391 ms) : 0, 718391
BytebuddyAgent [candidate] (713.352 ms) : 0, 713352
GlobalTracer [baseline] (272.605 ms) : 0, 272605
GlobalTracer [candidate] (271.184 ms) : 0, 271184
AppSec [baseline] (47.26 ms) : 0, 47260
AppSec [candidate] (47.12 ms) : 0, 47120
IAST [baseline] (13.444 ms) : 0, 13444
IAST [candidate] (14.0 ms) : 0, 14000
Remote Config [baseline] (657.549 µs) : 0, 658
Remote Config [candidate] (644.199 µs) : 0, 644
Telemetry [baseline] (5.556 ms) : 0, 5556
Telemetry [candidate] (5.534 ms) : 0, 5534
section profiling
BytebuddyAgent [baseline] (623.524 ms) : 0, 623524
BytebuddyAgent [candidate] (635.052 ms) : 0, 635052
GlobalTracer [baseline] (349.377 ms) : 0, 349377
GlobalTracer [candidate] (354.392 ms) : 0, 354392
AppSec [baseline] (49.11 ms) : 0, 49110
AppSec [candidate] (49.782 ms) : 0, 49782
Remote Config [baseline] (648.533 µs) : 0, 649
Remote Config [candidate] (667.666 µs) : 0, 668
Telemetry [baseline] (5.346 ms) : 0, 5346
Telemetry [candidate] (5.481 ms) : 0, 5481
ProfilingAgent [baseline] (74.223 ms) : 0, 74223
ProfilingAgent [candidate] (75.628 ms) : 0, 75628
Profiling [baseline] (74.248 ms) : 0, 74248
Profiling [candidate] (75.652 ms) : 0, 75652

Load

Parameters

	Baseline	Candidate
commit	1.20.0-SNAPSHOT~42a3ef6e44	1.19.0-SNAPSHOT~da0fe7a8f0
config	baseline	candidate
end_time	2023-08-09T16:46:20	2023-08-09T17:04:26
start_time	2023-08-09T16:46:03	2023-08-09T17:04:09

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.19.0-SNAPSHOT~da0fe7a8f0, baseline=1.20.0-SNAPSHOT~42a3ef6e44
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.326 ms) : 1307, 1345
.   : milestone, 1326,
appsec (1.655 ms) : 1630, 1680
.   : milestone, 1655,
iast (1.451 ms) : 1427, 1475
.   : milestone, 1451,
profiling (1.477 ms) : 1451, 1503
.   : milestone, 1477,
tracing (1.448 ms) : 1424, 1472
.   : milestone, 1448,
section candidate
no_agent (1.338 ms) : 1319, 1357
.   : milestone, 1338,
appsec (1.663 ms) : 1638, 1687
.   : milestone, 1663,
iast (1.452 ms) : 1428, 1477
.   : milestone, 1452,
profiling (1.471 ms) : 1446, 1495
.   : milestone, 1471,
tracing (1.462 ms) : 1437, 1486
.   : milestone, 1462,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.326 ms [1.307 ms, 1.345 ms]	-
appsec	1.655 ms [1.63 ms, 1.68 ms]	329.055 µs (24.8%)
iast	1.451 ms [1.427 ms, 1.475 ms]	125.186 µs (9.4%)
profiling	1.477 ms [1.451 ms, 1.503 ms]	151.434 µs (11.4%)
tracing	1.448 ms [1.424 ms, 1.472 ms]	121.661 µs (9.2%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.338 ms [1.319 ms, 1.357 ms]	-
appsec	1.663 ms [1.638 ms, 1.687 ms]	324.642 µs (24.3%)
iast	1.452 ms [1.428 ms, 1.477 ms]	114.361 µs (8.5%)
profiling	1.471 ms [1.446 ms, 1.495 ms]	132.575 µs (9.9%)
tracing	1.462 ms [1.437 ms, 1.486 ms]	123.518 µs (9.2%)

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.19.0-SNAPSHOT~da0fe7a8f0, baseline=1.20.0-SNAPSHOT~42a3ef6e44
    dateFormat X
    axisFormat %s
section baseline
no_agent (361.995 µs) : 342, 382
.   : milestone, 362,
appsec (664.726 µs) : 643, 686
.   : milestone, 665,
iast (461.44 µs) : 441, 482
.   : milestone, 461,
iast_FULL (526.007 µs) : 505, 547
.   : milestone, 526,
iast_INACTIVE (429.507 µs) : 408, 451
.   : milestone, 430,
profiling (438.436 µs) : 417, 459
.   : milestone, 438,
tracing (440.536 µs) : 420, 461
.   : milestone, 441,
section candidate
no_agent (366.293 µs) : 345, 387
.   : milestone, 366,
appsec (654.93 µs) : 634, 675
.   : milestone, 655,
iast (445.845 µs) : 425, 466
.   : milestone, 446,
iast_FULL (521.233 µs) : 500, 542
.   : milestone, 521,
iast_INACTIVE (429.039 µs) : 408, 450
.   : milestone, 429,
profiling (446.942 µs) : 425, 469
.   : milestone, 447,
tracing (434.556 µs) : 413, 456
.   : milestone, 435,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	361.995 µs [341.987 µs, 382.004 µs]	-
appsec	664.726 µs [643.464 µs, 685.988 µs]	302.731 µs (83.6%)
iast	461.44 µs [440.675 µs, 482.205 µs]	99.445 µs (27.5%)
iast_FULL	526.007 µs [505.135 µs, 546.879 µs]	164.012 µs (45.3%)
iast_INACTIVE	429.507 µs [408.155 µs, 450.859 µs]	67.512 µs (18.6%)
profiling	438.436 µs [417.492 µs, 459.379 µs]	76.44 µs (21.1%)
tracing	440.536 µs [419.774 µs, 461.298 µs]	78.541 µs (21.7%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	366.293 µs [345.41 µs, 387.177 µs]	-
appsec	654.93 µs [634.482 µs, 675.378 µs]	288.637 µs (78.8%)
iast	445.845 µs [425.246 µs, 466.444 µs]	79.552 µs (21.7%)
iast_FULL	521.233 µs [500.358 µs, 542.108 µs]	154.939 µs (42.3%)
iast_INACTIVE	429.039 µs [408.264 µs, 449.814 µs]	62.745 µs (17.1%)
profiling	446.942 µs [424.792 µs, 469.093 µs]	80.649 µs (22.0%)
tracing	434.556 µs [413.259 µs, 455.853 µs]	68.262 µs (18.6%)

DDJavierSantos added the comp: asm iast Application Security Management (IAST) label Jul 4, 2023

smola changed the title ~~IAST - HSTS missing header vulnerability detection~~ HSTS missing header vulnerability detection Jul 4, 2023

smola reviewed Jul 4, 2023

View reviewed changes

This comment has been minimized.

Sign in to view

manuel-alvarez-alvarez reviewed Jul 4, 2023

View reviewed changes

Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/RequestEndedHandler.java Outdated

manuel-alvarez-alvarez reviewed Jul 4, 2023

View reviewed changes

Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/RequestEndedHandler.java Outdated

manuel-alvarez-alvarez reviewed Jul 4, 2023

View reviewed changes

Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/HttpResponseHeaderModuleImpl.java Outdated

DDJavierSantos requested review from manuel-alvarez-alvarez and smola July 7, 2023 07:39

DDJavierSantos marked this pull request as ready for review July 7, 2023 07:39

DDJavierSantos requested a review from a team July 7, 2023 07:39

DDJavierSantos requested a review from a team as a code owner July 7, 2023 07:39

DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch from 6c8e164 to db5151c Compare July 10, 2023 07:48

smola reviewed Jul 10, 2023

View reviewed changes

Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/HttpResponseHeaderModuleImpl.java Outdated

Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/RequestEndedHandler.java Outdated

manuel-alvarez-alvarez requested a review from anderruiz July 11, 2023 14:12

manuel-alvarez-alvarez reviewed Jul 11, 2023

View reviewed changes

Comment thread dd-java-agent/agent-jmxfetch/integrations-core Outdated

manuel-alvarez-alvarez reviewed Jul 11, 2023

View reviewed changes

Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/IastRequestContext.java Outdated

DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch from db5151c to c3bb107 Compare July 11, 2023 16:11

DDJavierSantos requested review from manuel-alvarez-alvarez and smola July 13, 2023 09:23

smola requested changes Jul 13, 2023

View reviewed changes

Comment thread dd-java-agent/agent-jmxfetch/integrations-core

Comment thread ...boot-2.6-webmvc/src/main/java/datadog/smoketest/springboot/controller/IastWebController.java Outdated

manuel-alvarez-alvarez reviewed Jul 14, 2023

View reviewed changes

Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/HttpResponseHeaderModuleImpl.java Outdated

DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch 2 times, most recently from 074fc49 to 0d4ee5c Compare July 31, 2023 08:52

DDJavierSantos requested review from manuel-alvarez-alvarez and smola July 31, 2023 11:02

manuel-alvarez-alvarez reviewed Jul 31, 2023

View reviewed changes

Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/RequestEndedHandler.java Outdated

manuel-alvarez-alvarez reviewed Jul 31, 2023

View reviewed changes

Comment thread ...n/servlet/request-2/src/main/java/datadog/trace/instrumentation/servlet2/Servlet2Advice.java Outdated

manuel-alvarez-alvarez reviewed Jul 31, 2023

View reviewed changes

Comment thread internal-api/src/main/java/datadog/trace/api/iast/sink/HttpResponseHeaderModule.java Outdated

DDJavierSantos force-pushed the jsantos/hsts_vulnerability branch from 270459b to ec3ff11 Compare August 2, 2023 07:42